Your Ex-Employee Might Still Have Access to Company Data

When someone leaves your company, their access does not leave with them. Unless IT blocks the account, ends active sessions, collects the devices and changes every shared password they knew, a former employee can often still open email, cloud files, the VPN and the office Wi-Fi weeks later. The fix is a written offboarding checklist that runs on the last working day, every time.

This guide gives Singapore SMEs a practical checklist, explains where the PDPA comes in, and shows tools that help, including Microsoft 365 Business Premium, Microsoft 365 Business Basic, the Fortinet FortiGate-40F and the ASUS ExpertBook B1.

The employee offboarding IT checklist

Why do ex-employees keep access after they leave?

Because access is spread across places nobody owns as a whole. The email account gets disabled, so everyone assumes the job is done, while the person still has a session on their phone, a supplier-portal login and the Wi-Fi key on a personal laptop. Also remove their authenticator app or phone number from any shared or admin account, and deactivate door cards and alarm codes.

Sign-outs also take time. Microsoft's own guidance for removing a former employee says to reset the password first, then use "Sign out of all sessions". The user is prompted to sign in again "within an hour", because an access token is good for an hour, and Microsoft notes that blocking an account "can take up to 24 hours to take effect". That is why the password reset comes first, before the block.

How do you remove a former employee from Microsoft 365?

Microsoft lists seven steps: prevent sign-in, save the mailbox contents, wipe and block the mobile device, forward email or convert to a shared mailbox, give another employee access to OneDrive and Outlook data, remove and delete the licence, and delete the user account. Two details matter:

• Data clocks start ticking. Microsoft states that after you delete an employee's account, the content in their OneDrive and Outlook is retained for 30 days, during which you can restore the account. Hand files over before you delete.
• Licences can be reused. "When you remove a license, you can assign it to someone else." Reclaiming seats is how offboarding pays for itself. Our post on tracking IT subscriptions and SaaS sprawl shows how to keep a seat register so licences do not sit unused.

If you manage laptops and phones centrally, Microsoft 365 Business Premium (S$335.00 per user for 12 months, as listed on 23 Oct 2026) is the tier Microsoft documents for businesses with up to 300 users that need Intune device management, multifactor authentication and Defender for Business. For staff who only need the cloud services and web and mobile apps,Microsoft 365 Business Basic (S$107.00 per user for 12 months) keeps the cost per seat down. Browse the full range in our Microsoft 365 for Business collection.

What about laptops and personal phones?

Company laptops should come back on the last day, be checked against your asset register, and be backed up and reset before they are reissued. A remote action helps when a device does not come back. Microsoft's Intune documentation describes the Wipe action as a factory reset that "removes all personal and organizational data, apps, and configurations", which is why Microsoft frames full wipes around corporate-owned devices. For a personal phone that only carries work apps, remove the company data and apps through your device management tool rather than wiping the whole phone, and say so in your BYOD policy before people join. The trade-offs are covered in Should Companies Ban Personal Laptops From Their Office Network?

Standard business laptops make the reset routine. The ASUS ExpertBook B1 B1403CVA-NJ1209X (S$1,499.00, in stock) ships with Windows 11 Pro, which its listing notes is ready for Microsoft Entra ID join and Intune management, plus TPM 2.0 and a fingerprint reader.

Shared passwords, Wi-Fi keys and the VPN

This is where most offboarding falls apart: shared logins for supplier portals, the domain registrar or the office NAS are rarely written down. Keep them in a business password manager so you can see who had access. When someone leaves, rotate the ones they could see. Our post Your Company Password Policy Might Be Making Security Worse explains why fewer, stronger credentials plus MFA beat frequent forced changes.

Remote access deserves its own line. If staff connect through a firewall VPN, disable their VPN account at the exit time. A business firewall such as the Fortinet FortiGate-40F with 24x7 FortiCare and UTM (S$1,065.00 for the 1-year bundle, available to order) keeps user accounts and policies in one place, which makes the removal quick to audit. For background, see our guides to FortiGate firewalls for small businesses and secure remote access with Aruba Instant On. See also The Most Dangerous Device in Your Office Might Be the One Nobody Manages.

What does the PDPA expect when staff leave?

The PDPA has no offboarding checklist, but its obligations apply. Under the Protection Obligation, the PDPC says organisations must make "reasonable security arrangements" to protect personal data in their possession "to prevent unauthorised access, collection, use, disclosure or similar risks." A former employee who can still open the customer database is the definition of unauthorised access.

If something does go wrong, the Data Breach Notification Obligation applies. The PDPC's guide on managing data breaches says a breach involving 500 or more individuals is of significant scale; organisations must assess a suspected breach within 30 calendar days, and must notify the PDPC no later than three calendar days after determining that a breach is notifiable. The cost side of a lost device is covered in One Stolen Laptop. How Much Could It Really Cost Your Business?, and ransomware defence in our ransomware prevention guide.

Our view: make offboarding boring

One school says trust your people: most leavers have no interest in old data, and a heavy process feels like an accusation. The other says every leaver is a risk. Both miss the point. A leaver who means no harm can still have an old session on a phone that gets lost.

Offboarding is not about distrust. It is about closing every door you opened, on the same day, every time.

SourceIT's view: make the checklist dull and repeatable. HR triggers it, IT runs it, a manager signs it off, and it is the same for the director as for the intern.

Buying Microsoft 365, firewalls and business laptops in Singapore

SourceIT supplies Microsoft 365 subscriptions, Fortinet firewalls and ASUS business laptops to Singapore companies with a GST invoice; Fortinet is supplied with local warranty. Prices are as listed on 23 Oct 2026. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg, or see volume discounts and special pricing. Government buyers can reach us through GeBIZ and Vendors@Gov.

Frequently asked questions

What should IT do on an employee's last day? Reset the password, sign the user out of all sessions, block sign-in, disable VPN access, collect devices, and hand over mail and files to a manager. Then rotate shared passwords and reclaim licences.

How quickly does "Sign out of all sessions" work in Microsoft 365? Microsoft says the user is prompted to sign in again within an hour, because an access token lasts an hour. Blocking sign-in can take up to 24 hours, which is why Microsoft says to reset the password first.

How long does Microsoft 365 keep a deleted user's data? Microsoft states that OneDrive and Outlook content is retained for 30 days after the account is deleted, and the account can be restored during that time.

Can I wipe a former employee's personal phone? An Intune Wipe is a factory reset that removes personal and organisational data, so it suits company-owned devices. For personal phones, remove only company apps and data, and set this out in your BYOD policy.

Does the PDPA require an offboarding process? The PDPA does not prescribe one, but the Protection Obligation requires reasonable security arrangements to prevent unauthorised access to personal data, which includes removing leavers' access.

Should we change the office Wi-Fi password when someone leaves? If the leaver knew a shared Wi-Fi key, yes. A longer-term fix is individual Wi-Fi logins for staff, so one account can be removed without changing the key for everyone.